ath6kl: Fix random rx data corruption

The skb->tail pointer of rx buffers is not adjusted
after skb->data pointer is aligned to 4-byte, this
causes random rx data corruption.

Signed-off-by: Jin Navy <nhjin@qca.qualcomm.com>
Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@qca.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

diff --git a/drivers/net/wireless/ath/ath6kl/txrx.c b/drivers/net/wireless/ath/ath6kl/txrx.c
index cf4380d573c4a47b05320f7ae5958577e2a7a821..c4501a9f051cb3adb992b2a3e3a9d61292ecce16 100644 (file)
--- a/drivers/net/wireless/ath/ath6kl/txrx.c
+++ b/drivers/net/wireless/ath/ath6kl/txrx.c
@@ -894,8 +894,11 @@ void ath6kl_rx_refill(struct htc_target *target, enum htc_endpoint_id endpoint)
                        break;
 
                packet = (struct htc_packet *) skb->head;
-               if (!IS_ALIGNED((unsigned long) skb->data, 4))
+               if (!IS_ALIGNED((unsigned long) skb->data, 4)) {
+                       size_t len = skb_headlen(skb);
                        skb->data = PTR_ALIGN(skb->data - 4, 4);
+                       skb_set_tail_pointer(skb, len);
+               }
                set_htc_rxpkt_info(packet, skb, skb->data,
                                   ATH6KL_BUFFER_SIZE, endpoint);
                packet->skb = skb;
@@ -917,8 +920,11 @@ void ath6kl_refill_amsdu_rxbufs(struct ath6kl *ar, int count)
                        return;
 
                packet = (struct htc_packet *) skb->head;
-               if (!IS_ALIGNED((unsigned long) skb->data, 4))
+               if (!IS_ALIGNED((unsigned long) skb->data, 4)) {
+                       size_t len = skb_headlen(skb);
                        skb->data = PTR_ALIGN(skb->data - 4, 4);
+                       skb_set_tail_pointer(skb, len);
+               }
                set_htc_rxpkt_info(packet, skb, skb->data,
                                   ATH6KL_AMSDU_BUFFER_SIZE, 0);
                packet->skb = skb;